In order to detect breakdowns or losses of performance within a telecommunications network, it is conventional to associate a network management system therewith.
The network management system has means for acquiring data coming from network equipment (routers, switches, repeaters, connections, etc.).
The data can constitute alarms or merely measurements.
Alarms are notified by a piece of network equipment when it has detected a problem (a deficiency, a value crossing a threshold, etc.).
Measurements are values transmitted by pieces of network equipment when there is no such problem situation. They can correspond to a “push” model, i.e. they can be transmitted on request from the network management system. Such transmission can be performed periodically.
They can also correspond to a “pull” model. Under such circumstances, the measurements are available in databases located at the pieces of network equipment. These databases are generally referred to as a management information base (MIB). The management system can then read these measurements by accessing the MIB databases.
On the basis of this data, the network management system is then required to detect any problems and to characterize them.
The network management system may also have the function of determining the impact of these problems on the services conveyed by the network and on the performance thereof.
In order to perform this function correctly, it is important for the network management system to have data available that satisfies constraints in terms of speed and accuracy.
The data is acquired by sensors positioned on all or some of the pieces of equipment in the network, and is then transited to the network management system.
Nevertheless, insofar as the number of pieces of network equipment to be monitored can be large, it is necessary to find a compromise.
It is penalizing to acquire all of the possible data about the network since that would overload:                the network management system which would have to process all of the data;        the monitored network itself (the data often being conveyed by the network's own communications means); and        the monitored pieces of network equipment which need to perform processing in order to transmit measurements and alarms.        
In contrast, the less data that is available to the network management system, the less capable it is of performing its function properly. In particular, if a data item available about some piece of network equipment is not measured sufficiently often, then the network management system can fail to detect that a threshold is exceeded. An example of such undersampling is illustrated by FIG. 1.
In FIG. 1, there can be seen a curve showing how a value V measured on a piece of network equipment varies as a function of time T. V can be the rate at which packets are lost, for example. The network management system associates a threshold S with this value and it is considered that an alarm needs to be triggered when the threshold is exceeded. The crosses represent measurement points.
It can clearly be seen that the curve can cross the threshold without that being detected, since all of the measured values (the crosses) lie beneath the threshold line S.
In the prior art, a compromise is therefore sought during the stage of configuring the network management system. The person in charge of configuring needs to determine where to place sensors, and where appropriate, the periodicity with which data needs to be acquired.
Nevertheless, such a solution is insufficient since it relies on the assumption that the network does not vary over time. In contrast, the Applicant is of the opinion that network variation leads to a loss of performance in network management systems in the present state of the art.
Network variation can be due to traffic variation or indeed to a change to the network itself (adding a piece of equipment to the network, dynamic reconfiguration of routing schemes, etc.).
One solution for solving that problem consists in placing an intermediate layer between the sensors and the network management system proper. The sensors are configured to acquire the maximum possible amount of data and to transmit it to the intermediate layer. The function of the intermediate layer is to filter and correlate the data so as to forward a usable fraction only to the network management system.
The network management system can modify the intermediate layer dynamically so as to modify filtering and correlation criteria as a function of how the network varies.
As an example of the state of the art, mention can be made of the “Temip” product provided by the supplier Compaq, or indeed any network management software based on a rules management product such as “Ilog Rules” from the supplier Ilog.
Nevertheless, that solution is not genuinely satisfactory.
Firstly, it requires additional processing to be added that is implemented in the intermediate layer. Since the intermediate layer acquires the maximum possible amount of data, the additional processing requires enormous processing resources.
It should also be observed that a good portion of this processing can be completely useless since it relates to data in which the network management system will take no interest at any given instant. The problem of network overload due to taking measurements remains.
Furthermore, that technique does not enable modifications to network configuration to be taken into account: if a piece of equipment is added to the network, it will not be taken into account by the network management system unless the network management system is reconfigured manually.
Another solution in the state of the art is described in the article “A passive test and measurement system: traffic sampling for QoS evaluation” by Irene Cozzani and Stefano Giordana, of the University of Pisa. The authors propose varying sampling rates so as to improve the pertinence of the data that is collected.
Nevertheless, such a solution does not solve all of the problems raised above. In particular, it does not solve those that might arise when a new element is added to the network, or when overloading (or more generally a problem) appears in a new location.